Building with AI: Our Approach to Responsible Agentic Development in Open Source

The tech world has been building up towards the shift to a fully agentic development life cycle for a few years now. AI is changing how software gets built. 

Across the Puppet ecosystem, we’re seeing a shift toward more agentic engineering workflows. AI helps generate code, shape documentation, and accelerate how Puppet modules evolve. This brings real benefits in speed and consistency, but it also raises important questions from the community: 

• How are AI-generated changes validated? 
• How do you ensure consistency across modules? 
• What does this mean for contributors and maintainers? 

These are exactly the kinds of questions we should be asking! This article will outline how Perforce and the Puppet team are approaching the use of AI in our open source modules and repositories. 

How We Build Trust in AI-Assisted Contributions 

At Perforce, AI is a core part of our process and our teams operate within a defined, governed framework for development. We don’t rely on trust in the tool itself. We rely on the processes around it. 

Whether a change is written by a person, generated with AI, or some mix of both, they are held to the same standards before it’s accepted and released.  

In practice, that means: 

• Human review is always the gate:  
  Every change is reviewed by maintainers. AI can assist, but it doesn’t replace accountability. 
• AI works within established patterns:  
  AI-generated code isn’t created in isolation. It’s guided by the same module structures, conventions, and expectations that already exist across the ecosystem. 
• Validation is continuous and enforced:  
  AI doesn’t change our standards. It reinforces them. AI-generated changes go through the same checks as any other contribution: 
  • Test suites 
  • Integration validation 
  • Functional verification 
• AI output is a starting point, not a final artifact: 
  Generated code is iterated on, refined, and aligned before acceptance. We treat AI as an accelerator, not an authority. 
• The community plays an important role 
  Open source means visibility. The community can review changes, raise issues, and contribute ideas. That feedback loop adds another layer of resilience and helps shape how these workflows evolve. 

At a high level, our approach is simple: the outcome matters more than how the code was created. 

Community Contributions and AI 

Community members are not required to use code assist tools when providing contributions to Puppet open source projects, even when those projects contain frameworks or files designed to support coding agents. 

Contributions can be made using any tools or workflows that work best for you and there is no expectation to match the Perforce technology stack. While the Puppet team will be adding instructions, skills, and other artifacts to support agentic workflows, including tools like Claude Code, these are provided as optional enhancements, not requirements.  

When contributions are reviewed, the same standards apply regardless of how they were created. This includes contributions that contain AI-generated code, are submitted by AI agents, or have been tested or reviewed using AI tools. We welcome contributions in any form, but all submissions go through the same review and approval process before they are accepted and released. 

Maintaining Consistency Across the Ecosystem 

Another important question we hear is how we avoid duplication or inconsistency as AI becomes part of the workflow. This is where ecosystem-level thinking and governance matter most and where we will be incrementally improving our engineering patterns. 

Here’s how we approach that: 

• Changes are evaluated in context  
  We don’t review contributions in isolation. We look at how they relate to existing modules and whether similar functionality already exists. 
• Reuse is prioritized over duplication  
  When reviewing changes, we actively ask whether something can be reused instead of reimplemented. This helps maintain DRY principles across the ecosystem—not just within a single module. 
• Shared patterns guide development  
  AI-assisted changes are aligned to standard module structures, established design patterns, and proven implementation approaches. This helps ensure consistency even as contribution velocity increases. 
• Documentation is treated as part of the system  
  Generated documentation and supporting artifacts are treated as first-class components. This improves clarity, supports reuse, and helps maintain long-term consistency across modules. 

Governance Is Built In, Not Bolted On 

Building with AI tools is not left to individual discretion. AI usage at Perforce follows structured processes designed to ensure quality, security, and accountability across the lifecycle. 

Here’s what that looks like for Puppet open source teams: 

• AI tools and workflows are intentionally reviewed  
  We evaluate how AI tools are used within our development process, including how they interact with existing systems and patterns. Only tools approved for use by the Perforce AI governance team can be used for agentic development by Perforce employees. 
• Risks and dependencies are actively managed  
  Using agentic development flows introduces new considerations from code duplication to unintended behaviors. These are identified, reviewed, and addressed as part of normal development workflows. 
• Security and compliance are built into the process  
  AI-assisted development operates within the same security, permission, and compliance boundaries as any other contribution. 

AI usage is part of a broader AI management system aligned with ISO 42001, ensuring responsible use across the lifecycle.  

We also recognize the broader concerns around AI. We’re deliberate about how and where AI is used. At its core, governance is about maintaining control while enabling progress. AI should operate within the systems teams already trust, not bypass them. 

Our Commitment to the Open Source Community  

This evolution isn’t happening in isolation. The Puppet modules team works within an open source ecosystem and it’s important that the community is informed about AI usage and included so that all members of the community are able to provide feedback as these processes evolve.  

Our goal is to provide: 

• Clear communication about AI-assisted changes 
• Transparency in how contributions are reviewed 
• Ongoing dialogue as workflows evolve 

This is a new world of software delivery that we all maintainers and contributors are collaborating in, and we’ll need to work together to find the right process for everyone. 

What This Means Going Forward 

The agentic software development lifecycle is going to continue to shift and grow. AI will continue to play a growing role in how modules are developed and maintained.  

In your favorite Puppetlabs modules, you are going to see: 

• Structural documentation, skills, instructions, and other frameworks to support agentic development 
• More AI-assisted contributions to open source repos 
• More structured documentation that aligns across the ecosystem 
• An increase in iteration cycles as agentic workflows grow and stabilize 

There is one thing that won’t change: Every contribution will be held to the same standards of quality, consistency, and trust. 

In the end, trust in AI doesn’t come from the model. It comes from the systems, processes, and people behind it. 

We want to hear from the community as we continue to evolve these practices and develop a solid agentic-supported workflow for our open source community. We’d love your feedback, so please share your thoughts here or in the Puppet Community Slack. 

Additional Resources 

These additional resources could be helpful if you are interested in this topic and want to learn more! 

• AI Governance at Perforce (trust.perforce.com) 
• Perforce AI Products and Features Achive ISO 42001 Certification (perforce.com)